Right, of course. Easy enough to misdirect to a different wallet by 'hacking' the record down river. DNSSEC looks like a good solution to that problem...